Vulnerability · Published Mar 18, 2026 · Assigned by OpenText

CVE-2026-3278XSS Vulnerability discovered in OpenText™ ZENworks Service Desk.

High 7.4

In plain English

A high-severity cross-site scripting in ZENworks Service Desk from OpenText™. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)7.4High

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting (XSS). The vulnerability could allow an attacker to execute arbitrary JavaScript leading to unauthorized actions on behalf of the user.This issue affects ZENworks Service Desk: 25.2, 25.3.

Affected products (as reported)

Vendor	Product	Versions
OpenText™	ZENworks Service Desk	25.225.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

References

https://portal.microfocus.com/s/article/KM000045873?language=en_US